Analysis
-
max time kernel
28s -
max time network
24s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
23-12-2021 14:54
Static task
static1
General
-
Target
Results12232021.xls
-
Size
631KB
-
MD5
59212fd7cad43916cc463c7ef87d188d
-
SHA1
4f5062437f794bab251ba87bbcc6c424c00491d8
-
SHA256
d48e9dc2d8ce89aa5eb4a90b4eb2d60368fd7e3bdcfeb9a8a7cda9b11ac40e7e
-
SHA512
f6830814de3cf57b5c940b6f5c03375222cf11b9b71d4e1b0a72cb88fcd87147c9ec1e9e1af0d9141a2606555152a421687a8c23a290a2a29f5cfa2581da1d6d
Malware Config
Extracted
dridex
22201
144.91.122.102:443
85.10.248.28:593
185.4.135.27:5228
80.211.3.13:8116
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
WMIC.exemshta.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1120 904 WMIC.exe EXCEL.EXE Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1088 584 mshta.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 624 584 regsvr32.exe -
Processes:
resource yara_rule behavioral1/memory/1928-65-0x000000006C1C0000-0x000000006C24C000-memory.dmp dridex_ldr -
Blocklisted process makes network request 2 IoCs
Processes:
mshta.exeflow pid process 5 1088 mshta.exe 7 1088 mshta.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1928 regsvr32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEmshta.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 904 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 1120 WMIC.exe Token: SeSecurityPrivilege 1120 WMIC.exe Token: SeTakeOwnershipPrivilege 1120 WMIC.exe Token: SeLoadDriverPrivilege 1120 WMIC.exe Token: SeSystemProfilePrivilege 1120 WMIC.exe Token: SeSystemtimePrivilege 1120 WMIC.exe Token: SeProfSingleProcessPrivilege 1120 WMIC.exe Token: SeIncBasePriorityPrivilege 1120 WMIC.exe Token: SeCreatePagefilePrivilege 1120 WMIC.exe Token: SeBackupPrivilege 1120 WMIC.exe Token: SeRestorePrivilege 1120 WMIC.exe Token: SeShutdownPrivilege 1120 WMIC.exe Token: SeDebugPrivilege 1120 WMIC.exe Token: SeSystemEnvironmentPrivilege 1120 WMIC.exe Token: SeRemoteShutdownPrivilege 1120 WMIC.exe Token: SeUndockPrivilege 1120 WMIC.exe Token: SeManageVolumePrivilege 1120 WMIC.exe Token: 33 1120 WMIC.exe Token: 34 1120 WMIC.exe Token: 35 1120 WMIC.exe Token: SeIncreaseQuotaPrivilege 1120 WMIC.exe Token: SeSecurityPrivilege 1120 WMIC.exe Token: SeTakeOwnershipPrivilege 1120 WMIC.exe Token: SeLoadDriverPrivilege 1120 WMIC.exe Token: SeSystemProfilePrivilege 1120 WMIC.exe Token: SeSystemtimePrivilege 1120 WMIC.exe Token: SeProfSingleProcessPrivilege 1120 WMIC.exe Token: SeIncBasePriorityPrivilege 1120 WMIC.exe Token: SeCreatePagefilePrivilege 1120 WMIC.exe Token: SeBackupPrivilege 1120 WMIC.exe Token: SeRestorePrivilege 1120 WMIC.exe Token: SeShutdownPrivilege 1120 WMIC.exe Token: SeDebugPrivilege 1120 WMIC.exe Token: SeSystemEnvironmentPrivilege 1120 WMIC.exe Token: SeRemoteShutdownPrivilege 1120 WMIC.exe Token: SeUndockPrivilege 1120 WMIC.exe Token: SeManageVolumePrivilege 1120 WMIC.exe Token: 33 1120 WMIC.exe Token: 34 1120 WMIC.exe Token: 35 1120 WMIC.exe Token: SeIncreaseQuotaPrivilege 1876 wmic.exe Token: SeSecurityPrivilege 1876 wmic.exe Token: SeTakeOwnershipPrivilege 1876 wmic.exe Token: SeLoadDriverPrivilege 1876 wmic.exe Token: SeSystemProfilePrivilege 1876 wmic.exe Token: SeSystemtimePrivilege 1876 wmic.exe Token: SeProfSingleProcessPrivilege 1876 wmic.exe Token: SeIncBasePriorityPrivilege 1876 wmic.exe Token: SeCreatePagefilePrivilege 1876 wmic.exe Token: SeBackupPrivilege 1876 wmic.exe Token: SeRestorePrivilege 1876 wmic.exe Token: SeShutdownPrivilege 1876 wmic.exe Token: SeDebugPrivilege 1876 wmic.exe Token: SeSystemEnvironmentPrivilege 1876 wmic.exe Token: SeRemoteShutdownPrivilege 1876 wmic.exe Token: SeUndockPrivilege 1876 wmic.exe Token: SeManageVolumePrivilege 1876 wmic.exe Token: 33 1876 wmic.exe Token: 34 1876 wmic.exe Token: 35 1876 wmic.exe Token: SeIncreaseQuotaPrivilege 1876 wmic.exe Token: SeSecurityPrivilege 1876 wmic.exe Token: SeTakeOwnershipPrivilege 1876 wmic.exe Token: SeLoadDriverPrivilege 1876 wmic.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
EXCEL.EXEpid process 904 EXCEL.EXE 904 EXCEL.EXE 904 EXCEL.EXE 904 EXCEL.EXE 904 EXCEL.EXE 904 EXCEL.EXE 904 EXCEL.EXE 904 EXCEL.EXE 904 EXCEL.EXE 904 EXCEL.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
EXCEL.EXEmshta.exeregsvr32.exedescription pid process target process PID 904 wrote to memory of 1120 904 EXCEL.EXE WMIC.exe PID 904 wrote to memory of 1120 904 EXCEL.EXE WMIC.exe PID 904 wrote to memory of 1120 904 EXCEL.EXE WMIC.exe PID 904 wrote to memory of 1120 904 EXCEL.EXE WMIC.exe PID 1088 wrote to memory of 1876 1088 mshta.exe wmic.exe PID 1088 wrote to memory of 1876 1088 mshta.exe wmic.exe PID 1088 wrote to memory of 1876 1088 mshta.exe wmic.exe PID 624 wrote to memory of 1928 624 regsvr32.exe regsvr32.exe PID 624 wrote to memory of 1928 624 regsvr32.exe regsvr32.exe PID 624 wrote to memory of 1928 624 regsvr32.exe regsvr32.exe PID 624 wrote to memory of 1928 624 regsvr32.exe regsvr32.exe PID 624 wrote to memory of 1928 624 regsvr32.exe regsvr32.exe PID 624 wrote to memory of 1928 624 regsvr32.exe regsvr32.exe PID 624 wrote to memory of 1928 624 regsvr32.exe regsvr32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Results12232021.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" process call create "mshta.exe C:\ProgramData\ObJMSUicvQMNfixpwYXSqjW.rtf"2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\mshta.exemshta.exe C:\ProgramData\ObJMSUicvQMNfixpwYXSqjW.rtf1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic process call create "regsvr32.exe -s C:\\ProgramData\tlnigger.bin"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s C:\\ProgramData\tlnigger.bin1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s C:\\ProgramData\tlnigger.bin2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ObJMSUicvQMNfixpwYXSqjW.rtfMD5
3cd5368d256af8d6717f2b19b898e4ea
SHA165120398e528bc397ce7f27ef07173fe54d596a3
SHA2563f43b76d12ea7f6c64fc76d1c510f7ce798e753db26d78898992b7beb1a1a88d
SHA51202131862163d2274277b9857f296cf14a63d3f44bd173388f6f0b3d92db75b5cc2ba83589970bb91e48a15e7cb041692d6e60313c979e53fcc55ca4c655950f2
-
C:\ProgramData\tlnigger.binMD5
932edd5c60a6f8f0ba664d86c2666858
SHA105bbed7f81d175b74f5d8b81b249af89141cbd30
SHA256783bd484843b735ee56ae545096340316f72ad5d6c7ffca781d4c11d93d19a14
SHA512717508749ca0b938f4bba2cebd53ccbb7b1ddf40453799240de179ca6a929d5e274cd5c5a0e48d8520af1031c2af0929ce4fcfbfc7a9290d5171a8ac115f050a
-
\ProgramData\tlnigger.binMD5
932edd5c60a6f8f0ba664d86c2666858
SHA105bbed7f81d175b74f5d8b81b249af89141cbd30
SHA256783bd484843b735ee56ae545096340316f72ad5d6c7ffca781d4c11d93d19a14
SHA512717508749ca0b938f4bba2cebd53ccbb7b1ddf40453799240de179ca6a929d5e274cd5c5a0e48d8520af1031c2af0929ce4fcfbfc7a9290d5171a8ac115f050a
-
memory/624-60-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmpFilesize
8KB
-
memory/904-55-0x0000000071421000-0x0000000071423000-memory.dmpFilesize
8KB
-
memory/904-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/904-54-0x000000002F7D1000-0x000000002F7D4000-memory.dmpFilesize
12KB
-
memory/1120-57-0x0000000000000000-mapping.dmp
-
memory/1876-59-0x0000000000000000-mapping.dmp
-
memory/1928-62-0x0000000000000000-mapping.dmp
-
memory/1928-63-0x00000000762C1000-0x00000000762C3000-memory.dmpFilesize
8KB
-
memory/1928-65-0x000000006C1C0000-0x000000006C24C000-memory.dmpFilesize
560KB
-
memory/1928-67-0x0000000000140000-0x0000000000146000-memory.dmpFilesize
24KB